> ## Documentation Index
> Fetch the complete documentation index at: https://axiom-mano-sample-app.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# parse_ipv4

> This page explains how to use the parse_ipv4 function in APL.

The `parse_ipv4` function in APL extracts the four octets of an IPv4 address and represents them as integers. You can use this function to break down an IPv4 address into its constituent components for advanced analysis, filtering, or comparisons. It is especially useful for tasks like analyzing network traffic logs, identifying trends in IP address usage, or performing security-related queries.

## For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

<AccordionGroup>
  <Accordion title="Splunk SPL users">
    In Splunk SPL, extracting IPv4 components requires using regular expressions or string manipulation. APL simplifies this process with the dedicated `parse_ipv4` function.

    <CodeGroup>
      ```sql Splunk example
      | eval octets=split("192.168.1.1", ".") | table octets
      ```

      ```kusto APL equivalent
      ['sample-http-logs']
      | extend octets = parse_ipv4('192.168.1.1')
      | project octets
      ```
    </CodeGroup>
  </Accordion>

  <Accordion title="ANSI SQL users">
    In ANSI SQL, breaking down an IPv4 address often requires using functions like `SUBSTRING` or `SPLIT`. APL offers the `parse_ipv4` function as a straightforward alternative.

    <CodeGroup>
      ```sql SQL example
      SELECT SPLIT_PART(ip, '.', 1) AS octet1, SPLIT_PART(ip, '.', 2) AS octet2 FROM logs
      ```

      ```kusto APL equivalent
      ['sample-http-logs']
      | extend octets = parse_ipv4('192.168.1.1')
      | project octets
      ```
    </CodeGroup>
  </Accordion>
</AccordionGroup>

## Usage

### Syntax

```kusto
parse_ipv4(ipv4_address)
```

### Parameters

| Parameter      | Type   | Description                                    |
| -------------- | ------ | ---------------------------------------------- |
| `ipv4_address` | string | The IPv4 address to parse into integer octets. |

### Returns

The function returns an array of four integers, each representing an octet of the IPv4 address.

## Use case example

You can use the `parse_ipv4` function to analyze web traffic by breaking down user IP addresses into octets.

**Query**

```kusto
['sample-http-logs']
| extend ip_octets = parse_ipv4('192.168.1.1')
```

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20extend%20ip_octets%20%3D%20parse_ipv4\('192.168.1.1'\)%22%7D)

**Output**

| \_time              | uri         | method | ip\_octets    |
| ------------------- | ----------- | ------ | ------------- |
| 2024-11-14T10:00:00 | /index.html | GET    | 3,232,235,777 |

## List of related functions

* [has\_any\_ipv4](/apl/scalar-functions/ip-functions/has-any-ipv4): Matches any IP address in a string column with a list of IP addresses or ranges.
* [has\_ipv4\_prefix](/apl/scalar-functions/ip-functions/has-ipv4-prefix): Checks if an IPv4 address matches a single prefix.
* [has\_ipv4](/apl/scalar-functions/ip-functions/has-ipv4): Checks if a single IP address is present in a string column.
* [ipv4\_compare](/apl/scalar-functions/ip-functions/ipv4-compare): Compares two IPv4 addresses lexicographically. Use for sorting or range evaluations.
* [ipv4\_is\_in\_range](/apl/scalar-functions/ip-functions/ipv4-is-in-range): Checks if an IP address is within a specified range.
* [ipv4\_is\_private](/apl/scalar-functions/ip-functions/ipv4-is-private): Checks if an IPv4 address is within private IP ranges.